1

Practical demonstration ofBananb Target Collisions forSkein with NIST KAT files
Presented byDanilo Gligoroski
Department of Telematics,
Faculty of Information Technology, Mathematics and Electrical Engineering
Norwegian University of Science and TechnologyTechnology - NTNU, NORWAY

Rump Session, CRYPTO 2011, Practical demonstration of Bananb Target Collisions with NIST KAT files

2

Last year at CRYPTO 2010, Rump Session

Banana Attack
On Blue Midnight Wish by Gaëtan Leurent

Rump Session, CRYPTO 2011, Practical demonstration of Bananb Target Collisions with NIST KAT files

3

Last year at CRYPTO 2010, Rump Session

Banana Attack
On Blue Midnight Wish by Gaëtan Leurent
This year on Rump Session

Bananb Attack
On Skein (and others)
Rump Session, CRYPTO 2011, Practical demonstration of Bananb Target Collisions with NIST KAT files

4CRYPTO 2010, Rump Session

Bananb Attack isBanana Attacka OnphilosophicalBlue Midnight Wish by Xxxx
sibling toBananb Attack
BananaAttack
On Skein, BLAKE andmaybe others
Rump Session, CRYPTO 2011, Practical demonstration of Bananb Target Collisions with NIST KAT files

5Demonstration of Bananb
Target Collisions for Skeinwith NIST KAT files
Message 1: ”Banana Attacks are crap”

Rump Session, CRYPTO 2011, Practical demonstration of Bananb Target Collisions with NIST KAT files

6

Demonstration of Bananb
Target Collisions for Skein
with NIST KAT files
Message 1: ”Banana Attacks are crap”

Message 2: ”Banana Attacks are craq”

Rump Session, CRYPTO 2011, Practical demonstration of Bananb Target Collisions with NIST KAT files

7

Demonstration of Bananb
Target Collisions for Skein
with NIST KAT files
Message 1: ”h(s&@h3w%!Banana Attacks are crap”
Message 2: ”h(s&@h3w%!Banana Attacks are craq”

Prepend a garbage(computed by an undisclosedalgorithm)

Rump Session, CRYPTO 2011, Practical demonstration of Bananb Target Collisions with NIST KAT files

8Demonstration of Bananb
Target Collisions for Skein
with NIST KAT files
Transform tohexadecimal

Message 1: ”h(s&@h3w%!Banana Attacks are crap”
6828732640683377252142616E616E612041747461
636B73206172652063726170
Message 2: ”h(s&@h3w%!Banana Attacks are craq”
6828732640683377252142616E616E612041747461
636B73206172652063726171

Rump Session, CRYPTO 2011, Practical demonstration of Bananb Target Collisions with NIST KAT files

9Demonstration of Bananb
Target Collisions for Skein
with NIST KAT filesProduce a NIST

KAT file
ShortMsgKAT.txt# ShortMsgKAT.txt# Algorithm Name: Practical demonstration of Bananb Target Collisions for Skein with NIST KAT files# Principal Submitter: Danilo Gligoroski for the Rump Session CRYPTO 2011
Len = 260
Msg = 6828732640683377252142616E616E612041747461636B73206172652063726170
MD = ??
Len = 260
Msg = 6828732640683377252142616E616E612041747461636B73206172652063726171
MD = ??

Rump Session, CRYPTO 2011, Practical demonstration of Bananb Target Collisions with NIST KAT files

10

Demonstration of Bananb
Target Collisions for Skein
with NIST KAT files
forSkein and run genKAT256.exe
Compileprovided in Skein submission
package over ShortMsgKAT.txt andsee the produced file
ShortMsgKAT_256.txt# ShortMsgKAT.txt# Algorithm Name: Practical demonstration of Bananb Target Collisions for Skein with NIST KAT files# Principal Submitter: Danilo Gligoroski for the Rump Session CRYPTO 2011
Len = 260
Msg = 6828732640683377252142616E616E612041747461636B73206172652063726170
MD = ??
Len = 260
Msg = 6828732640683377252142616E616E612041747461636B73206172652063726171
MD = ??

Rump Session, CRYPTO 2011, Practical demonstration of Bananb Target Collisions with NIST KAT files

11

Demonstration of Bananb
Target Collisions for Skein
with NIST KAT files# ShortMsgKAT_256.txt# Algorithm Name: Practical demonstration of Bananb Target Collisions for Skein with NIST KAT files# Principal Submitter: Danilo Gligoroski for the Rump Session CRYPTO 2011
Len = 260
Msg = 6828732640683377252142616E616E612041747461636B73206172652063726170
MD = EBFEF527B76D55D886A5B91E64765274BFCAB9E78253F3411B4A0840CA5055D2
Len = 260
Msg = 6828732640683377252142616E616E612041747461636B73206172652063726171
MD = EBFEF527B76D55D886A5B91E64765274BFCAB9E78253F3411B4A0840CA5055D2

Rump Session, CRYPTO 2011, Practical demonstration of Bananb Target Collisions with NIST KAT files

12

Why Skein, why not theother SHA-3 finalists?

Rump Session, CRYPTO 2011, Practical demonstration of Bananb Target Collisions with NIST KAT files

13

Why Skein, why not theother SHA-3 finalists?
• Well, personally I could do BLAKE too, but I am notinterested for the others
amd64; Sandy Bridge (206a7);
2011 Intel Core i7-2600K; 4 x3400MHz; threads; sandy0,supercop-20110708

64‐bit mode,
Speed
512 bit hash cycles/byte
1.skein512
7.83
2.blake512
7.94
3.sha512
11.67
4.keccakc512
12.84
5.jh512
13.70
6.groestl512
15.59
Rump Session, CRYPTO 2011, Practical demonstration of Bananb Target Collisions with NIST KAT files

14

Rump Session, CRYPTO 2011, Practical demonstration of Bananb Target Collisions with NIST KAT files